State of the Practice of Computer Security Incident Response Teams ...
State of the Practice of Computer Security Incident Response Teams ...
State of the Practice of Computer Security Incident Response Teams ...
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
CIO CYBERTHREAT REPORT FORM<br />
This form outlines <strong>the</strong> basic information law enforcement needs on a first call. You can use it as an internal worksheet<br />
or fill it out and e-mail or fax it to law enforcement. Additional data that will help agents in <strong>the</strong>ir investigation<br />
is outlined in <strong>the</strong> CIO Cyberthreat <strong>Response</strong> & Reporting Guidelines, but <strong>the</strong> best way to determine what will be<br />
most helpful to investigators in <strong>the</strong> event <strong>of</strong> an attack is to ask.<br />
STATUS<br />
Site Under Attack Past <strong>Incident</strong> Repeated <strong>Incident</strong>s, unresolved<br />
CONTACT INFORMATION<br />
Name_____________________________________________________Title___________________________________________<br />
Organization______________________________________________________________________________________________<br />
Direct-Dial Phone__________________________________________ E-mail__________________________________________<br />
Legal Contact Name_________________________________________________Phone________________________________<br />
Location/Site(s) Involved___________________________________________________________________________________<br />
Street Address____________________________________________________________________________________________<br />
City_____________________________________________________<strong>State</strong>____________________IP______________________<br />
Main Telephone__________________________________________Fax______________________________________________<br />
ISP Contact Information___________________________________________________________________________________<br />
INCIDENT DESCRIPTION<br />
Denial <strong>of</strong> Service<br />
Unauthorized Electronic Monitoring (sniffers)<br />
Distributed Denial <strong>of</strong> Service<br />
Misuse <strong>of</strong> Systems (internal or external)<br />
Malicious Code (virus, worm)<br />
Website Defacement<br />
Intrusion/Hack<br />
Probe/Scan<br />
O<strong>the</strong>r (specify)_________________________________________________________________________________________<br />
DATE/TIME OF INCIDENT DISCOVERY<br />
Date______________________________________________Time___________________________________________________<br />
Duration <strong>of</strong> Attack_________________________________________________________________________________________<br />
IMPACT OF ATTACK<br />
Loss/Compromise <strong>of</strong> Data<br />
System Downtime<br />
Damage to Systems<br />
Financial Loss (estimated amount: >$_______________________)<br />
Damage to <strong>the</strong> Integrity or Delivery <strong>of</strong> Critical Goods, Services or Information<br />
O<strong>the</strong>r Organizations’ Systems Affected<br />
SEVERITY OF ATTACK, INCLUDING FINANCIAL LOSS, INFRASTRUCTURE, PR IMPACT IF MADE PUBLIC<br />
High Medium Low Unknown<br />
SENSITIVITY OF DATA<br />
High Medium Low Unknown<br />
How did you detect this?___________________________________________________________________________________<br />
Have you contacted law enforcement about this incident before? Who & when?_________________________________<br />
Has <strong>the</strong> incident been resolved? Explain_____________________________________________________________________
Change language